A new double-extortion ransomware variant targets VMware ESXi servers, security researchers have found. The group behind it, named Cicada3301, has been promoting its ransomware-as-a-service operation since June.
Once an attacker has initial access to a corporate network, they can copy and encrypt its private data using the Cicada3301 ransomware. They can then withhold the decryption key and threaten to expose the data on Cicada3310’s dedicated leak site to force the victim into paying a ransom.
Cicada3301’s leak site has listed at least 20 victims, predominantly in North America and England, according to Morphisec. Businesses were of all sizes and came from a number of industries, including manufacturing, healthcare, retail, and hospitality.
Sweden-based security company Truesec first became aware of the group when it posted on the cybercrime forum RAMP on June 29 in an attempt to recruit some new affiliates. However, BleepingComputer says it has been made aware of Cicada attacks as early as June 6.
How the ransomware works
Attackers gain entry by brute-forcing or stealing valid credentials and logging in remotely via ScreenConnect and executing the ransomware.
ESXi’s “esxcli” and “vim-cmd” commands are first executed to shut down VMs and delete any snapshots. The ransomware then uses the ChaCha20 cipher and a symmetric key generated using the random number generator “Osrng” to encrypt the files.
All files under 100 MB are encrypted in their entirety, while intermittent encryption is applied to larger ones. The encryption function targets certain file extensions associated with documents and pictures, including docx, xslx, and pptx. The Truesec researchers say this indicates that the ransomware was originally used to encrypt Windows systems before being ported for ESXi hosts.
Random seven-character extensions are added to the encrypted file names that are then used to denote their respective recovery notes, stored in the same folder. This is also a technique used by leading RaaS group BlackCat/ALPHV.
Cicada3301 ransomware allows for the operator to execute a number of custom parameters that could assist them in evading detection. For example, “sleep” delays the encryption by a defined number of seconds, and “ui” provides real-time data about the encryption process, such as the number of files encrypted.
When the encryption is complete, the ChaCha20 symmetric key is encrypted with an RSA key. This is needed to decrypt the recovery instructions, and the threat actors can hand it over once payment has been made.
The attacker can also exfiltrate the victim’s data and threaten to post it on the Cicada3301 leak site for additional leverage.
SEE: Massive ransomware operation targets VMware ESXi: How to protect from this security threat
Cyber attackers impersonating real organisation
The ransomware group is impersonating a legitimate organisation named “Cicada 3301,” responsible for a famous series of cryptography games. There is no connection between the two, despite the threat actors having stolen its logo and branding.
SEE: Ransomware Cheat Sheet for 2024
The Cicada 3301 puzzle project has released a statement distancing itself from the RaaS group, saying: “We do not know the identity of the criminals behind these heinous crimes, and are not associated with these groups in any way.”
There are a number of similarities between Cicada3301 and ALPHV/BlackCat that led researchers to believe they are connected. ALPHV/BlackCat’s servers went down in March, so it would be viable for the new group to represent either a rebrand or a spin-off initiated by some of its core members.
Cicada3301 could also consist of a different group of attackers who simply bought the ALPHV/BlackCat source code after it ceased operation.
As well as ALPHV/BlackCat, the Cicada3301 ransomware has been connected to a botnet named “Brutus.” The IP address of a device to log into a victim’s network via ScreenConnect is linked to “a broad campaign of password guessing various VPN solutions” by Brutus, Truesec says.
Cicada3310 could be a rebrand or spin-off of ALPHV/BlackCat
ALPHV/BlackCat ceased operations after a sloppily executed cyber attack against Change Healthcare in February. The group did not pay an affiliate their percentage of the $22 million ransom, so the affiliate exposed them, prompting ALPHV to fake a law enforcement takeover and turn off their servers.
SEE: BlackCat/ALPHV Ransomware Site Seized in International Takedown Effort
Cicada3301 could represent an ALPHV/BlackCat rebrand or off-shoot group. There are also a number of similarities between their ransomware, for example:
- Both are written in Rust.
- Both use the ChaCha20 algorithm for encryption.
- Both employ identical VM shutdown and snapshot-wiping commands.
- Both use the same user interface command parameters, the same file naming convention, and the same ransom note decryption method.
- Both use intermittent encryption on larger files.
Furthermore, brute-forcing activities from the Brutus botnet, which has now been linked to Cicada3310, were first spotted just two weeks after ALPHV/BlackCat shut down its servers in March.
VMware ESXi is becoming a popular ransomware target
Truesec said the Cicada 3310 ransomware is used on both Windows and Linux/VMware ESXi hosts. VMware ESXi is a bare-metal hypervisor that enables the creation and management of virtual machines directly on server hardware, which may include critical servers.
The ESXi environment has become the target of many cyberattacks of late, and VMware has been frantically providing patches as new vulnerabilities emerge. Compromising the hypervisor can allow attackers to disable multiple virtual machines simultaneously and remove recovery options such as snapshots or backups, ensuring significant impact on a business’s operations.
Such focus highlights cyberattackers’ interest in the huge payday available from executing maximum damage on corporate networks.
ADVERTISEMENT:
Informasi mengenai KING SLOT, Segera Daftar Bersama king selot terbaik dan terpercaya no satu di Indonesia. Boleh mendaftar melalui sini king slot serta memberikan hasil kembali yang paling tinggi saat sekarang ini hanyalah KING SLOT paling gacor, gilak dan gaco saat sekarang di Indonesia melalui program return tinggi di kingselot serta pg king slot
suara88 permainan paling top dan garansi imbal balik hasil besar bersama https://suara88.biz/
sumo7777 permainan paling top dan garansi imbal balik hasil besar bersama https://sumo7777.com/
supermoney888 permainan paling top dan garansi imbal balik hasil besar bersama https://supermoney888.biz/
teratai88 permainan paling top dan garansi imbal balik hasil besar bersama https://teratai88.biz/
thor88 permainan paling top dan garansi imbal balik hasil besar bersama https://thor88.biz/
togelhk88 permainan paling top dan garansi imbal balik hasil besar bersama https://togelhk88.net/
topjitu88 permainan paling top dan garansi imbal balik hasil besar bersama https://topjitu88.net/
totosloto88 permainan paling top dan garansi imbal balik hasil besar bersama https://totosloto88.com/
trisula888 permainan paling top dan garansi imbal balik hasil besar bersama https://trisula888.biz/
udangbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://udangbet88.net/
via88 permainan paling top dan garansi imbal balik hasil besar bersama https://via88.biz/
virusjp88 permainan paling top dan garansi imbal balik hasil besar bersama https://virusjp88.net/
warga888 permainan paling top dan garansi imbal balik hasil besar bersama https://warga888.biz/
waw88 permainan paling top dan garansi imbal balik hasil besar bersama https://waw88.biz/
winjitu88 permainan paling top dan garansi imbal balik hasil besar bersama https://winjitu88.net/
wisdom88 permainan paling top dan garansi imbal balik hasil besar bersama https://wisdom88.biz/
wnitogel88 permainan paling top dan garansi imbal balik hasil besar bersama https://wnitogel88.com/
yoyo888 permainan paling top dan garansi imbal balik hasil besar bersama https://yoyo888.biz/
validtoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://validtoto88.com/
sule999 permainan paling top dan garansi imbal balik hasil besar bersama https://sule999.com/
sule88 permainan paling top dan garansi imbal balik hasil besar bersama https://sule88.org/
ss888bet permainan paling top dan garansi imbal balik hasil besar bersama https://ss888bet.com/
sia77 permainan paling top dan garansi imbal balik hasil besar bersama https://sia77.info/
seluang88 permainan paling top dan garansi imbal balik hasil besar bersama https://seluang88.com/
satu88 permainan paling top dan garansi imbal balik hasil besar bersama https://satu88.biz/
satu777 permainan paling top dan garansi imbal balik hasil besar bersama https://satu777.asia/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp88.biz/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp88.asia/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp77.live/
qiuqiu88 permainan paling top dan garansi imbal balik hasil besar bersama https://qiuqiu88.biz/
pt88 permainan paling top dan garansi imbal balik hasil besar bersama https://pt88.org/
pt77 permainan paling top dan garansi imbal balik hasil besar bersama https://pt77.info/
produk88 permainan paling top dan garansi imbal balik hasil besar bersama https://produk88.asia/
mt88 permainan paling top dan garansi imbal balik hasil besar bersama https://mt88.org/
mt77 permainan paling top dan garansi imbal balik hasil besar bersama https://mt77.biz/
menang66 permainan paling top dan garansi imbal balik hasil besar bersama https://menang66.biz/
latobet888 permainan paling top dan garansi imbal balik hasil besar bersama https://latobet888.org/
kedai96 permainan paling top dan garansi imbal balik hasil besar bersama https://kedai96.org/
kedai188 permainan paling top dan garansi imbal balik hasil besar bersama https://kedai188.biz/
ids88 permainan paling top dan garansi imbal balik hasil besar bersama https://ids88.biz/
hp88 permainan paling top dan garansi imbal balik hasil besar bersama https://hp88.org/
hp77 permainan paling top dan garansi imbal balik hasil besar bersama https://hp77.org/
gm88 permainan paling top dan garansi imbal balik hasil besar bersama https://gm88.asia/
gm77 permainan paling top dan garansi imbal balik hasil besar bersama https://gm77.net/
final888 permainan paling top dan garansi imbal balik hasil besar bersama https://final888.org/
duit88 permainan paling top dan garansi imbal balik hasil besar bersama https://duit88.asia/
duit168 permainan paling top dan garansi imbal balik hasil besar bersama https://duit168.biz/
divisi88 permainan paling top dan garansi imbal balik hasil besar bersama https://divisi88.org/
dewi500 permainan paling top dan garansi imbal balik hasil besar bersama https://dewi500.biz/
devil88 permainan paling top dan garansi imbal balik hasil besar bersama https://devil88.info/
cuputoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://cuputoto88.com/
cukongbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://cukongbet88.asia/
bom888 permainan paling top dan garansi imbal balik hasil besar bersama https://bom888.biz/
bintaro888 permainan paling top dan garansi imbal balik hasil besar bersama https://bintaro888.info/
askasino88 permainan paling top dan garansi imbal balik hasil besar bersama https://askasino88.org/
999aset permainan paling top dan garansi imbal balik hasil besar bersama https://999aset.com/
afb77 permainan paling top dan garansi imbal balik hasil besar bersama https://afb77.biz/
aset99 permainan paling top dan garansi imbal balik hasil besar bersama https://aset99.biz/
bendera77 permainan paling top dan garansi imbal balik hasil besar bersama https://bendera77.biz/
bendera888 permainan paling top dan garansi imbal balik hasil besar bersama https://bendera888.com/
coco88 permainan paling top dan garansi imbal balik hasil besar bersama https://coco88.org/
cuma77 permainan paling top dan garansi imbal balik hasil besar bersama https://cuma77.biz/
cuma88 permainan paling top dan garansi imbal balik hasil besar bersama https://cuma88.org/
dwv88 permainan paling top dan garansi imbal balik hasil besar bersama https://dwv88.org/
fafajp88 permainan paling top dan garansi imbal balik hasil besar bersama https://fafajp88.com/
gemar88 permainan paling top dan garansi imbal balik hasil besar bersama https://gemar88.biz/
gocap88 permainan paling top dan garansi imbal balik hasil besar bersama https://gocap88.info/
gocaptoto permainan paling top dan garansi imbal balik hasil besar bersama https://gocaptoto.asia/
hakabet88 permainan paling top dan garansi imbal balik hasil besar bersama https://hakabet88.com/
hwtoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://hwtoto88.org/
ina77 permainan paling top dan garansi imbal balik hasil besar bersama https://ina77.biz/
ina88 permainan paling top dan garansi imbal balik hasil besar bersama https://ina88.info/
jingga8888 permainan paling top dan garansi imbal balik hasil besar bersama https://jingga8888.com/
juragan777 permainan paling top dan garansi imbal balik hasil besar bersama https://juragan777.asia/
kastil77 permainan paling top dan garansi imbal balik hasil besar bersama https://kastil77.info/
kebo888 permainan paling top dan garansi imbal balik hasil besar bersama https://kebo888.biz/
kkwin77 permainan paling top dan garansi imbal balik hasil besar bersama https://kkwin77.com/
kokoslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://kokoslot88.asia/
luckydf88 permainan paling top dan garansi imbal balik hasil besar bersama https://luckydf88.org/
microstar888 permainan paling top dan garansi imbal balik hasil besar bersama https://microstar888.biz/
monperatoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://monperatoto88.com/
mpo1122 permainan paling top dan garansi imbal balik hasil besar bersama https://mpo1122.biz/
mpo122 permainan paling top dan garansi imbal balik hasil besar bersama https://mpo122.biz/
mpopelangi88 permainan paling top dan garansi imbal balik hasil besar bersama https://mpopelangi88.com/
pamanslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://pamanslot88.biz/
panel88 permainan paling top dan garansi imbal balik hasil besar bersama https://panel88.org/
paragon77 permainan paling top dan garansi imbal balik hasil besar bersama https://paragon77.biz/
paragon888 permainan paling top dan garansi imbal balik hasil besar bersama https://paragon888.info/
pion77 permainan paling top dan garansi imbal balik hasil besar bersama https://pion77.biz/
prada88 permainan paling top dan garansi imbal balik hasil besar bersama https://prada88.asia/
prada888 permainan paling top dan garansi imbal balik hasil besar bersama https://prada888.com/
qqslot88slot permainan paling top dan garansi imbal balik hasil besar bersama https://qqslot88slot.com/
rejekibet88 permainan paling top dan garansi imbal balik hasil besar bersama https://rejekibet88.com/
rezekibet88 permainan paling top dan garansi imbal balik hasil besar bersama https://rezekibet88.org/
sensa77 permainan paling top dan garansi imbal balik hasil besar bersama https://sensa77.biz/
sensa888 permainan paling top dan garansi imbal balik hasil besar bersama https://sensa888.biz/
singajp88 permainan paling top dan garansi imbal balik hasil besar bersama https://singajp88.com/
sr77 permainan paling top dan garansi imbal balik hasil besar bersama https://sr77.org/
sr88 permainan paling top dan garansi imbal balik hasil besar bersama https://sr88.org/
surya77 permainan paling top dan garansi imbal balik hasil besar bersama https://surya77.biz/
surya88 permainan paling top dan garansi imbal balik hasil besar bersama https://surya88.asia/
tajir77 permainan paling top dan garansi imbal balik hasil besar bersama https://tajir77.info/
tajir88 permainan paling top dan garansi imbal balik hasil besar bersama https://tajir88.biz/
toto122 permainan paling top dan garansi imbal balik hasil besar bersama https://toto122.com/
toto123 permainan paling top dan garansi imbal balik hasil besar bersama https://toto123.biz/
uangvip88 permainan paling top dan garansi imbal balik hasil besar bersama https://uangvip88.com/
wajik77 permainan paling top dan garansi imbal balik hasil besar bersama https://wajik77.asia/
777neko permainan paling top dan garansi imbal balik hasil besar bersama https://777neko.org/
88judi permainan paling top dan garansi imbal balik hasil besar bersama https://88judi.net/
99judi permainan paling top dan garansi imbal balik hasil besar bersama https://99judi.org/
abcslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://abcslot88.asia/
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
situs slot terbaru
slot terbaru
